Entering specific or more broad subnet on devices in regards to Security.

[CiscoPurpleBelt]

Just checking with the community.

Let's say you have an environment where all traffic external traffic is checked at the Firewall.

Example:

ip route 10.10.10.115 255.255.255.248 1.1.1.1 and

ip route 10.10.10.30  255.255.255.248 1.1.1.1

as opposed to 

ip route 10.10.10.0 255.255.255.0 1.1.1.1

Would you still prefer to enter specific route statements as opposed to using a CIDR to cover everything in addition to IPs that are not allowed at the Firewall? As the network grows you would have much more routes compared to less routes entered on your devices so what are you thoughts from that standpoint? 

[Georg Pauwen · Accepted solution]

Hello,

are the 10.10.10.x networks external or internal networks ? What is the destination,1.1.1.1 ? Is that an external or internal destination ? In general, for external routing, the firewall would need only a default route.

ip route 0.0.0.0 0.0.0.0 1.1.1.1

[CiscoPurpleBelt]

No all IPs are external.

[Georg Pauwen]

Hello,

the default route should be sufficient then. It is what you typically see on firewalls.

[paul driver · Accepted solution]

Hello

Longer-prefixes are always most preffered, A router will always choose a more specifc route, if their a multple routes with the same length then admistrative distance of the routing protocol or static route comes into play.

[CiscoPurpleBelt]

Yes but what about from a management/admin and security standpoint. 

Let's say you have a bunch of single host IP destinations that don't all fall in the same subnets. You would have a lot of statements to add as opposed to just adding one large subnet statement which would allow all those IPs but then many more which is not needed, however yes they are blocked the the FW so still would not pass through the Firewall anyway.

[Richard Burts · Accepted solution]

I am sure that there are aspects of this question that I do not understand fully. But it seems to me that the question is asking about 2 aspects of configuring and managing firewalls (and perhaps other network equipment). One aspect is configuring and administering the firewall. From this perspective summarization/CIDR makes it easier and so might be preferred. The other aspect is security on the firewall. From this perspective more granular control (more entries with more specific masks) is better. These perspectives might be mutually exclusive (easy to have one, difficult to have both). Both perspectives are valid, but probably one is more important to the organization than the other. Which one is most important in your organization?

If I have misunderstood something please provide clarification.

[CiscoPurpleBelt]

Yes that was what I was thinking. Well lets just say basically the decision is solely on me. I may just go with summarization since subnets are checked at the Firewall.

[Richard Burts · Accepted solution]

What I was trying to say in my response is that neither approach is inherently better than the other. It is a choice to be made organization by organization depending on the local criteria. Your choice of summarization sounds appropriate for your situation. Thanks for marking this question as solved. 

[CiscoPurpleBelt]

Thanks again Richard and Cisco Gurus!

[CiscoPurpleBelt]

Thanks again Paul and Cisco Gurus!

[Richard Burts]

You asked an interesting (and significant) question and have received multiple responses, each representing a different perspective. As we said there is not any single "one size fits all" right answer. There are multiple perspectives to consider and the best choice will depend on the particular organization for which the question is asked. Thank you for marking the question as solved.